What is the CVSS score of CVE-2026-11303?

CVE-2026-11303 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11303?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the PDF parser affecting any organization where users handle external PDF files.. A patch is available.

How to fix or mitigate CVE-2026-11303?

Within 24 hours: Identify Chrome browser versions deployed across your organization and communicate this vulnerability to teams that handle PDF documents. Within 7 days: Deploy Chrome version 149.0.7827.53 or later through automatic updates or via your patch management infrastructure (WSUS, MDM, Intune, etc.). Within 30 days: Verify that all Chrome instances have been updated to 149.0.7827.53 or later and confirm patch deployment compliance.

Google Chrome CVE-2026-11303

EUVD-2026-34764 HIGH

Use After Free (CWE-416)

2026-06-05 chrome-cve-admin@google.com

GHSA-cwjx-7rhw-fgp9

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:16 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the PDFium component that parses PDF documents. A remote attacker who lures a user into opening a crafted PDF can execute arbitrary code, though execution is contained within Chrome's renderer sandbox. No public exploit is identified at time of analysis, and SSVC indicates no observed exploitation.

Technical ContextAI

PDFium is the open-source PDF rendering engine embedded in Chromium-based browsers and is responsible for parsing, rasterizing, and interpreting PDF objects when a user opens a document in the browser. CWE-416 (Use After Free) indicates that memory referencing a freed PDF object is subsequently dereferenced, enabling an attacker who controls the freed allocation to redirect execution flow or corrupt adjacent heap state. Because PDFium runs inside Chrome's renderer process, successful exploitation yields code execution constrained by the renderer sandbox boundary, meaning a second sandbox-escape primitive would be required to reach the host OS.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade desktop installations to this stable channel build or later via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push the update through Group Policy, Jamf, Intune, or equivalent management tooling and force a browser restart to load the patched PDFium binary. As a temporary compensating control until rollout completes, disable Chrome's built-in PDF viewer by setting the 'AlwaysOpenPdfExternally' enterprise policy to true (trade-off: PDFs download instead of rendering inline, which degrades user experience but removes the PDFium attack surface), or block PDF email attachments at the gateway (trade-off: impacts legitimate business workflows). Users of Chromium-derivative browsers should track their vendor's matching release.